[PATCH] cipso: subtraction on unsigned hdr_delta

[PATCH] cipso: subtraction on unsigned hdr_delta

[Roel Kluin]

hdr_delta is unsigned, so take care not to subtract below 0.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 7bc9929..b1d862b 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1999,7 +1999,11 @@ void cipso_v4_sock_delattr(struct sock *sk)
 				iter++;
 		hdr_delta = opt->optlen;
 		opt->optlen = (optlen_new + 3) & ~3;
-		hdr_delta -= opt->optlen;
+
+		if (hdr_delta > opt->optlen)
+			hdr_delta -= opt->optlen;
+		else
+			hdr_delta = 0;
 	} else {
 		/* only the cipso option was present on the socket so we can
 		 * remove the entire option struct */

Re: [PATCH] cipso: subtraction on unsigned hdr_delta

[David Miller]

From: Roel Kluin <roel.kluin@gmail.com>
Date: Tue, 03 Mar 2009 23:23:38 +0100

> hdr_delta is unsigned, so take care not to subtract below 0.
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>

I'd like Paul to look at this.

It looks like it does the wrong thing when the option space increases,
which would have made hdr_delta negative if it were of a signed type.

I think therefore that sk_conn->icsk_ext_hdr_len needs to be adjusted
in both directions, just just when the option area length shrinks.

Re: [PATCH] cipso: subtraction on unsigned hdr_delta

[Paul Moore]

On Tuesday 03 March 2009 05:23:38 pm Roel Kluin wrote:
> hdr_delta is unsigned, so take care not to subtract below 0.
>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index 7bc9929..b1d862b 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1999,7 +1999,11 @@ void cipso_v4_sock_delattr(struct sock *sk)
>  				iter++;
>  		hdr_delta = opt->optlen;
>  		opt->optlen = (optlen_new + 3) & ~3;
> -		hdr_delta -= opt->optlen;
> +
> +		if (hdr_delta > opt->optlen)
> +			hdr_delta -= opt->optlen;
> +		else
> +			hdr_delta = 0;
>  	} else {
>  		/* only the cipso option was present on the socket so we can
>  		 * remove the entire option struct */

This patch isn't needed since I can't think of any sane reason why the 
hdr_delta subtraction would ever cause an error.  Similarly, I don't think 
David's concerns over the icsk_ext_hdr_len adjustment necessarily apply here 
either.  Let me try and explain, feel free to point out faults in my logic ...

This function, cipso_v4_sock_delattr(), is only used _to_ remove the CIPSO IP 
option from a socket, never to add it.  In the code snippet above we see the 
following three lines:

	hdr_delta = opt->optlen;
	opt->optlen = (optlen_new + 3) & ~3;
	hdr_delta -= opt->optlen;

The first line sets hdr_delta equal to length of the original IP option list 
(length includes the CIPSO option).  The second line calculates the new length 
of the IP option list (without the CIPSO option), complete with padding.  The 
third line subtracts the new option length from hdr_delta which is currently 
equal to original option length.  The only way that hdr_delta could ever be in 
danger of going negative would be if the removal of the CIPSO IP option caused 
the total IP option length to somehow increase; I just can't think how that 
would be possible.

-- 
paul moore
linux @ hp